> By default, any users are able to install firmware to removable hardware. The logic here is that if the hardware can be removed, it can easily be moved to a device that the user already has root access on, and asking for authentication would just be security theatre.<p>- <a href="http://www.fwupd.org/users.html" rel="nofollow">http://www.fwupd.org/users.html</a><p>But it is not given that a user has physical access to the machine, is it?<p>Well... I guess that's why it says "By default", and you can configure it? Seems targeted at desktop installations?
this has come at a good time. nearly all thinkpads are undergoing bios updates because of a security issue.. but cannot be done on Linux.<p>I wonder if someone can build a howto for Thinkpads on Linux.
This is actually pretty sweet. If you are running a non-linux OS you could just reboot into a live disk and pull down all of the updates.<p>Take it a step further, you could just PXE-boot into a scripted image that loads up and checks for FW updates, then reboots into the default OS when complete.